It appears EC2 uses a self-signed certificate to communicate with an Active Directory service somewhere on the EC2 network. It uses the certificate above to communicate with this, and tries to auto-renew periodically. It appears this mechanism has failed.